Code Execution
Here are the articles in this section:
T1117: regsvr32
regsvr32 (squiblydoo) code execution - bypass application whitelisting.
T1170: MSHTA
MSHTA code execution - bypass application whitelisting.
T1196: Control Panel Item
Control Panel Item code execution - bypass application whitelisting.
Executing Code as a Control Panel Item through an Exported Cplapplet Function
Code Execution through Control Panel Add-ins
T1191: CMSTP
CMSTP code execution - bypass application whitelisting.
T1118: InstallUtil
InstallUtil code execution - bypass application whitelisting.
Using MSBuild to Execute Shellcode in C#
T1202: Forfiles Indirect Command Execution
Defense Evasion
Application Whitelisting Bypass with WMIC and XSL
Powershell Without Powershell.exe
Powershell Constrained Language Mode ByPass
Understanding ConstrainedLanguageMode
Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
T1216: pubprn.vbs Signed Script Code Execution
Signed Script Proxy Execution - bypass application whitelisting using pubprn.vbs